This patch restores the API-key-free replay demo in standards-compliant browsers.
HTML form submission converts textarea line endings to CRLF, while the recorded Compiler fixture uses LF. Visual Contract now canonicalizes CRLF and legacy CR endings to LF at the shared brief-validation boundary before length validation, request hashing, compilation, and server-side persistence.
Verification:
- 131 tests passed with 88.45% coverage
- Ruff and dependency checks passed
- Real Chromium Brief → Contract → Audit flow passed in replay mode
- API attempts: 0
- Main+injection and holdout replay results remained unchanged
No fixture, observation, verdict, evaluation label, or published metric changed. build-week-feature-freeze and v0.1.0 remain fixed.
See release notes for details.